Access control of protected data using storage system-based multi-factor authentication
Techniques are provided for access control of protected data using storage system-based multi-factor authentication. One method comprises obtaining, in a storage system, an input/output request for data; determining, by the storage system, whether a multi-factor authentication is required for the requested data; initiating, by the storage system, a multi-factor authentication of a user associated with the input/output request, in response to a result of the determining, to obtain a verification result; and processing, in the storage system, the input/output request for the data based at least in part on the verification result. The data may be marked as protected data using a manual process and/or an automated process that processes one or more smart tags associated with the data. The marking of the data as protected data may comprise marking a partition comprising the data, marking a protected folder comprising the data, and/or marking a protected file comprising the data.
1. A method, comprising:
obtaining, in a storage system, at least one input/output operation requesting data, the storage system comprising at least one processing device and a plurality of storage devices that stores the requested data, the at least one processing device comprising a processor coupled to a memory;
determining, by the storage system, in response to the obtained at least one input/output operation requesting data, whether a multi-factor authentication is required for the requested data by evaluating whether at least a portion of the requested data is marked as protected data, wherein the marking as protected data provides an indication to the storage system to perform a multi-factor authentication in response to a request to access the protected data associated with the at least one input/output operation requesting data;
initiating, by the storage system, the multi-factor authentication of a user associated with the at least one input/output operation, in response to a result of the determining, to obtain a verification result; and
processing, in the storage system, the at least one input/output operation requesting data based at least in part on the verification result.
2. The method of claim 1 , wherein the multi-factor authentication comprises an out-of-band challenge of the user associated with the at least one input/output operation requesting data.
3. The method of claim 1 , further comprising obtaining a marking of the data as protected data.
4. The method of claim 3 , wherein the marking of the data as protected data is recorded in one or more of metadata associated with the data and in a protected data database.
5. The method of claim 3 , wherein the marking of the data as protected data is performed by one or more of a manual process and an automated process that processes one or more smart tags associated with the data.
6. The method of claim 3 , wherein the marking of the data as protected data comprises marking one or more of a partition comprising the data, a protected folder comprising the data, and a protected file comprising the data.
7. The method of claim 3 , wherein the protected data can only be accessed if the verification result is successful.
8. The method of claim 3 , wherein the marking of the data as protected data is maintained in response to a copy operation or a move operation performed on the data.
9. The method of claim 1 , wherein the determining whether the multi-factor authentication is required for the requested data further comprises determining whether the data is part of one or more of a protected partition, a protected folder, and a protected file.
10. An apparatus comprising:
at least one processing device of a storage system comprising a processor coupled to a memory;
the at least one processing device being configured to implement the following steps:
obtaining, in a storage system, at least one input/output operation requesting data, the storage system comprising at least one processing device and a plurality of storage devices that stores the requested data, the at least one processing device comprising a processor coupled to a memory;
determining, by the storage system, in response to the obtained at least one input/output operation requesting data, whether a multi-factor authentication is required for the requested data by evaluating whether at least a portion of the requested data is marked as protected data, wherein the marking as protected data provides an indication to the storage system to perform a multi-factor authentication in response to a request to access the protected data associated with the at least one input/output operation requesting data;
initiating, by the storage system, the multi-factor authentication of a user associated with the at least one input/output operation, in response to a result of the determining, to obtain a verification result; and
processing, in the storage system, the at least one input/output operation requesting data based at least in part on the verification result.
11. The apparatus of claim 10 , further comprising obtaining a marking of the data as protected data.
12. The apparatus of claim 11 , wherein the marking of the data as protected data is recorded in one or more of metadata associated with the data and in a protected data database.
13. The apparatus of claim 11 , wherein the marking of the data as protected data is performed by one or more of a manual process and an automated process that processes one or more smart tags associated with the data.
14. The apparatus of claim 11 , wherein the marking of the data as protected data comprises marking one or more of a partition comprising the data, a protected folder comprising the data, and a protected file comprising the data.
15. The apparatus of claim 10 , wherein the determining whether the multi-factor authentication is required for the requested data further comprises determining whether the data is part of one or more of a protected partition, a protected folder, and a protected file.
16. A non-transitory processor-readable storage medium having stored therein program code of one or more software programs, wherein the program code when executed by at least one processing device of a storage system causes the at least one processing device to perform the following steps:
obtaining, in a storage system, at least one input/output operation requesting data, the storage system comprising at least one processing device and a plurality of storage devices that stores the requested data, the at least one processing device comprising a processor coupled to a memory;
determining, by the storage system, in response to the obtained at least one input/output operation requesting data, whether a multi-factor authentication is required for the requested data by evaluating whether at least a portion of the requested data is marked as protected data, wherein the marking as protected data provides an indication to the storage system to perform a multi-factor authentication in response to a request to access the protected data associated with the at least one input/output operation requesting data;
initiating, by the storage system, the multi-factor authentication of a user associated with the at least one input/output operation, in response to a result of the determining, to obtain a verification result; and
processing, in the storage system, the at least one input/output operation requesting data based at least in part on the verification result.
17. The non-transitory processor-readable storage medium of claim 16 , further comprising obtaining a marking of the data as protected data.
18. The non-transitory processor-readable storage medium of claim 17 , wherein the marking of the data as protected data is performed by one or more of a manual process and an automated process that processes one or more smart tags associated with the data.
19. The non-transitory processor-readable storage medium of claim 17 , wherein the marking of the data as protected data comprises marking one or more of a partition comprising the data, a protected folder comprising the data, and a protected file comprising the data.
20. The non-transitory processor-readable storage medium of claim 16 , wherein the determining whether the multi-factor authentication is required for the requested data further comprises determining whether the data is part of one or more of a protected partition, a protected folder, and a protected file.